Experimental details.
We do experiments on two common image classification datasets: CIFAR-10 [1]} which has \(32\times 32\)  images, and ImageNet-100 [2]} with \(224\times 224\)  images where we take each tenth class following [3]}. We choose ImageNet-100 since we always perform a grid search over the main hyperparameters such as the perturbation radius for adversarial training
which would be too expensive to do on the full ImageNet. Unless mentioned otherwise, we use PreAct ResNet-18 architecture [4]}. We specify the exact hyperparameters in App. . We evaluate the accuracy on common corruptions using CIFAR-10-C and ImageNet-C datasets from [5]} which contain 15 different synthetic corruptions in 4 categories: blur, noise, digital, weather corruptions. We report the accuracy by averaging over all 5 severity levels.
The code of our experiments is publicly availablehttps://github.com/tml-epfl/adv-training-corruptions.
